diff --git a/s/cors b/s/cors
new file mode 100644
index 0000000..1c831f3
--- /dev/null
+++ b/s/cors
@@ -0,0 +1 @@
+add_header Access-Control-Allow-Origin * always;
diff --git a/s/listen b/s/listen
new file mode 100644
index 0000000..018660b
--- /dev/null
+++ b/s/listen
@@ -0,0 +1,2 @@
+listen 443 ssl;
+listen [::]:443 ssl;
diff --git a/s/matrix b/s/matrix
new file mode 100644
index 0000000..f0c8c3c
--- /dev/null
+++ b/s/matrix
@@ -0,0 +1,5 @@
+location /.well-known/matrix/ {
+  alias /var/www/.well-known/matrix/;
+  include s/cors;
+  add_header Content-Type application/json;
+}
diff --git a/s/reverse b/s/reverse
new file mode 100644
index 0000000..18dbc38
--- /dev/null
+++ b/s/reverse
@@ -0,0 +1,4 @@
+proxy_pass http://$upstream;
+proxy_http_version 1.1;
+proxy_set_header Host $host;
+proxy_set_header Connection "";
diff --git a/s/static b/s/static
new file mode 100644
index 0000000..13c2636
--- /dev/null
+++ b/s/static
@@ -0,0 +1,17 @@
+location ~* \.(?:manifest|appcache|html?|xml|json)$ {
+    expires -1;
+}
+
+location ~* \.(?:jpe?g|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
+    expires 1M;
+    add_header Cache-Control "public";
+}
+
+location ~* \.(?:css|js)$ {
+    expires 1y;
+    add_header Cache-Control "public";
+}
+
+location ~ /\.ht {
+    deny all;
+}
diff --git a/s/webapp b/s/webapp
new file mode 100644
index 0000000..f748372
--- /dev/null
+++ b/s/webapp
@@ -0,0 +1,3 @@
+location / {
+  try_files $uri $uri/ /index.html$is_args$args;
+}
diff --git a/s/websocket b/s/websocket
new file mode 100644
index 0000000..a431fe8
--- /dev/null
+++ b/s/websocket
@@ -0,0 +1,2 @@
+proxy_set_header Connection "upgrade";
+proxy_set_header Upgrade $http_upgrade;
diff --git a/s/xfwd b/s/xfwd
new file mode 100644
index 0000000..205001c
--- /dev/null
+++ b/s/xfwd
@@ -0,0 +1 @@
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;